Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-07 11:55Install Hook Abuse2026-09-07 11:44Install Hook Abuse2026-09-07 11:38Install Hook Abuse
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 84
Updated 10 Oct 2026, 20:21 UTC. Ordered by latest scan.
@yongot/canary-mcp-test@2.0.0
This is unconsented install-time command execution and host-data exfiltration to a third-party endpoint. The import-time trigger reinforces the malicious lifecycle behavior.
bmc-i18n-extract-cli@1.1.1
An automatic preinstall hook launches a deliberately obscured payload with concrete credential and outbound automation capabilities. This is malicious install-hook abuse.
bmc-translate-utils@1.1.1
This is a concrete malicious install-time chain: an automatic lifecycle hook executes an opaque payload with credential, network, filesystem, and process capabilities unrelated to the sta...
feishu-docx-mcp@0.3.2
The automatic preinstall hook executes a deliberately concealed, capability-rich payload. This is concrete install-hook abuse, not package-aligned setup.